You could also restrict the allowed XML so it can be parsed/generated without a full parser.